A web page can drop AGENTS.md or CLAUDE.md into ~/Downloads. Codex obeyed in over 90% of tries, Claude Code in about half
According to Forever Security, a web page can save a file into ~/Downloads without a click, and a coding agent started in that folder reads the instruction file it finds there. On 2026-10-22 Forever Security reported catching a planted AGENTS.md doing exactly that on a customer's Mac. Putting their…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-11-05 02:17 · DEV Community — AI
A web page can drop AGENTS.md or CLAUDE.md into ~/Downloads. Codex obeyed in over 90% of tries, Claude Code in about half